class nodo::utils::security::grsec (
  $ensure = 'installed',
) {
  package { [
    # The package with the specific image version might not be used
    # but right now apt is complaining of unmet dependencies when
    # trying to install only the metapackage maybe because both are
    # on jessie-backports. This might chance in the near future.
    'linux-image-4.9.0-2-grsec-amd64',
    'linux-image-grsec-amd64',
    'linux-headers-grsec-amd64',
    'paxtest',
  ]:
    ensure => $ensure,
  }
}